It reads your most confidential documents.

What leaves your environment, and to where

Your evidence is stored in our database and object storage, both encrypted at rest on our production infrastructure (managed Postgres and S3-compatible object storage). Only two things ever leave to an outside vendor, and only the minimum needed:

1. At ingest, chunk text is sent to our embedding provider to produce the vectors that power retrieval.
2. At answer time, a question plus the handful of retrieved snippets (never whole documents) are sent to our LLM provider to draft a grounded answer.

That is the entire external surface. We do not send whole documents, and we send retrieved snippets rather than your full corpus.

Bring your own keys (BYOK)

BYOK is live. You can supply your own Anthropic (LLM) API key under Settings, API keys. When you do, those external calls run on your own vendor account: your evidence transits your account, not ours, and you absorb that provider's cost.

Your key is stored encrypted at rest (authenticated encryption), decrypted only at the moment of the provider call, and never returned to the browser or written to logs. We only ever show its last four characters.

No training, zero or low retention

We use LLM and embedding providers under a no-training, zero or low retention data agreement. Your content is never used to train any model, and is not retained by the provider beyond what is required to serve the request.

Tenant and project isolation

Every query is scoped to your organization and to a specific project. One company can never retrieve another's data, and one product's questionnaire is only ever answered from that product's evidence. Both boundaries are enforced on every query and covered by automated cross-tenant and cross-project tests.

Handling of secrets and logs

• Document contents and full prompts are never written to logs.
• Provider API keys are held server-side only and never returned to the browser.
• Secrets and customer-provided API keys are encrypted at rest.
• Self-hosted deployments are available for organizations requiring custom host-level disk encryption.

Account and application security

• Your login session is kept in a hardened, HttpOnly cookie that page scripts cannot read, with cross-site request forgery (CSRF) protection on every state-changing action.
• Sign-in is protected by a strong-password policy, rate limiting, and account lockout after repeated failed attempts, to blunt password guessing and credential stuffing.
• The service sends modern browser security headers (HSTS, a Content-Security-Policy, clickjacking and MIME-sniffing protections) on every response.
• Uploaded files are size-capped and screened for malicious archives (zip bombs), and exported spreadsheets are sanitized so a cell can never execute as a formula on a reviewer's machine.

Your control over your data

You can delete any document at any time. Deletion purges the original file, its derived chunks, and its embeddings, and removes it from retrieval. Any reused answer that had been grounded on a deleted source is flagged for re-verification rather than silently re-served.

Buyers who require that no data ever leave their own infrastructure should ask about self-hosted deployment.